c65716838748683755fdc8ec7035ea35f868e937e4e5824123f9915f8335d23a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 04:27

Target
334ce57303ad15622e9fe64f2d7aa86c_JaffaCakes118.dll
Size 340KB
Sample240710-e3hvcaydmg
SHA256 c65716838748683755fdc8ec7035ea35f868e937e4e5824123f9915f8335d23a
MD5 334ce57303ad15622e9fe64f2d7aa86c
SHA1 adfc13880b443d04b07e8aa02aa52ce39c7d64bc
SHA512 c74e16d38eb902c26f595c66511072cd74c2d8a7f5e6340cf725b2fd28618d3c0a6eae9e42574e20ffa20c8034ea4e5e5475ea9913bf36a6fb23fdf1300fffca
SSDEEP 3072:AvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:A206xWgGxLxWN40PDKR/JnX2P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4424	3644	rundll32.exe	82
PID 3644 wrote to memory of 4424	3644	rundll32.exe	82
PID 3644 wrote to memory of 4424	3644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\334ce57303ad15622e9fe64f2d7aa86c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\334ce57303ad15622e9fe64f2d7aa86c_JaffaCakes118.dll,#1
  2⤵
  PID:4424